Cloudflare Radar 2025 Year in Review

Internet connectivity is critically important to everyday communication, commerce, entertainment, and transportation. Our ongoing reliance on the Internet is reflected in continued global Internet traffic growth.

This trend line starts mid-January, allowing for Internet activity to normalize following the return to work and school after the New Year.

Generative AI continued its meteoric rise in 2025, as Claude, Perplexity, and Gemini are now the main rivals to ChatGPT. On social media, after the juggernauts Facebook, Instagram, and TikTok, Snapchat is now outperforming X, while in the metaverse, Roblox still holds its crown. Our category-specific lists represent the zeitgeist of Internet activity throughout the year and include both familiar and unexpected names. Overall, Google remains at the top of the ranking, but Instagram, and YouTube climbed in our top 10 in 2025.

The ranking methodology used here is based on aggregate data from 1.1.1.1.

SpaceX Starlink continues to bring satellite Internet connectivity to previously underserved or unserved locations. We analyzed aggregate request traffic volumes from the service's autonomous system (AS14593) during 2025.

Starlink is not yet available globally, and as such, graphs will not be displayed for locations where Cloudflare has not observed meaningful Starlink-related traffic.

The trend line is scaled relative to the actual traffic data, where Max is the peak observed request volume and 0 means no traffic was observed. Comparative trend lines are scaled relative to the Max value shown.

A Hilbert curve has unique visualization properties that make it useful for surveying the Internet's IPv4 address space.

Cloudflare Radar allows you to see Internet traffic at a country/region or autonomous system level. By using a Hilbert curve, we can get a holistic look at where traffic is coming from across the entire IPv4 Internet. The visualization below shows aggregate traffic to Cloudflare from January 1 to December 2, 2025, with IP addresses aggregated at a /20 level. That means that at the highest zoom level, each cell represents traffic from 4,096 IPv4 addresses.

Zoom and drag to explore areas of interest. If an ASN is selected, prefix shading is relative to the traffic seen for that ASN, not global traffic as a whole.

"Post-quantum" (PQ) refers to a set of cryptographic techniques designed to protect encrypted data from "harvest now, decrypt later" attacks by adversaries that have the ability to capture and store current data for future decryption by sufficiently advanced quantum computers. The Cloudflare Research team has been working on post-quantum cryptography since 2017, and regularly publishes updates on the state of the post-quantum Internet.

In October 2022, we enabled post-quantum key agreement on our network by default, but use of it requires that the browser support it as well. We have observed rapid growth in usage as browsers have enabled default support for it.

Cloudflare Radar's Bots Directory tracks hundreds of Verified Bots across over a dozen categories, each exhibiting unique traffic patterns. Here we show normalized daily request volume from the top 10 highest traffic Verified Bots plus "Other", which captures aggregate traffic for the remaining bots. Additional details can be found on individual bot pages in the Bots Directory.

The crawl-to-refer ratio metric is calculated by first mapping crawl requests for HTML pages based on the User-Agent header, and referral requests for HTML pages based on the Referer header, by platform (e.g., the ratio for Google is based on crawl requests from Google-owned bots, and referral requests from Google platforms). See the blog post for more details on this metric.

The y-axis here uses log scale to enable better visualization of all of the included series.

AI bots and crawlers have been in the news throughout 2025 as they voraciously consume content to train constantly evolving models. Controversy has followed them, as not all bots and crawlers respect content owner directives to restrict crawling activity. The data shown here for the top bots and crawlers is normalized to show trends in traffic volume over time. See the full list in the Data Explorer. (Because Googlebot and Bingbot crawl for both search indexing and AI model training, they are included here as well.)

AI bots tend to crawl content for three primary purposes: training, search, and user action. AI training bots crawl sites to gather content that is used to further train large language models (LLMs). AI search bots are retrieving content to support chat platform search capabilities, as well as retrieval-augmented generation (RAG). AI user action bots access Web content as part of a task or action directed by a user. Here we show normalized daily request volume for aggregated AI bot traffic broken out by crawl purpose.

Cloudflare works closely with AI model providers to ensure that Workers AI supports these models as soon as possible following their release, and we recently acquired Replicate to greatly expand our catalog of supported models. Since early 2025, Radar has provided visibility into the popularity of publicly available supported models (Workers AI model popularity) as well as the types of tasks (Workers AI task popularity) that these models perform, based on customer account share. The visualization below shows the distribution of the most popular AI models and tasks running on Workers AI.

AI bots, including training, search, and user action crawlers, have been in the news more frequently as content owners raise concerns about the amount of traffic that they are generating. We analyzed request traffic for HTML content and classified it as coming from a human, an AI bot, or another type of bot ("Non-AI"). (Googlebot crawls for both search indexing and AI training and is included as a separate entry due to its crawl volume.) Here we show how the share of traffic from AI bots changes across the year.

Modern web sites are complex productions, relying on a mix of frameworks, platforms, services, and tools. Using Cloudflare Radar's URL Scanner, we analyzed web sites associated with the top 5,000 domains to identify the most popular technologies in use across a number of categories.

Note that the data was collected across a subset of the top 5,000 domains, as not all have active web sites at their apex.

More than half of the dynamic traffic seen by Cloudflare is API related, and it continues to grow over time. Much of that API traffic is automated — that is, it has been determined to not be coming from a person using a browser or native mobile application. Based on their local environments, preferences, or requirements, developers use a variety of languages to develop these automated API clients.

We analyzed this automated API traffic to identify the top languages used to develop API clients, and the chart below shows their distribution during 2025. Go remained at the top of the list, with 20% of automated API requests made by Go-based clients.

Protecting and accelerating websites and applications for millions of customers, Cloudflare is in a unique position to measure search engine market share data. Our methodology uses the Referer header to identify the search engine sending traffic to customer sites and applications. Search engine market share data is presented as an overall aggregate, as well as broken out by device type and operating system.

For additional details, please refer to the quarterly Search Engine Referral Reports on Cloudflare Radar.

Protecting and accelerating websites and applications for millions of customers, Cloudflare is in a unique position to measure browser market share. Our methodology uses information from the User Agent and Client-Hints HTTP headers to identify the browser making content requests, along with the associated operating system. Browser market share data is presented as an overall aggregate, as well as broken out by device type and operating system.

For additional details, please refer to the quarterly Browser Market Share Reports on Cloudflare Radar.

The Internet plays an increasingly significant role in people's lives, but not everyone has reliable Internet access. Outages can result from events like natural disasters and cable cuts, or can occur when a government deliberately shuts down Internet connectivity.

The Cloudflare Radar Outage Center tracks these Internet disruptions, and uses Cloudflare traffic data for insights into their scope and duration.

Although Internet connections are most often marketed and sold with a focus on download speed, upload speed and latency are also important as we increasingly use videoconferencing, video chat, and livestreaming tools. Even with high speed connections, high latency can significantly impact Internet connection quality and the user experience.

Here we present a distribution of download speed, upload speed, idle latency, and loaded latency measurements from speed.cloudflare.com tests taken by users in the selected country/region throughout 2025.

The Internet Quality data presented in Cloudflare Radar and the Year in Review is based on test results from speed.cloudflare.com, but we wanted to better understand the test activity that supports the presented results. We aggregated Cloudflare Speed Test activity at a sub-national level across countries/regions around the world on a weekly basis, and plotted it on a map with the markers sized to correspond to the number of tests taken that week. Hotspots included the United Kingdom, United States, Hong Kong, and Japan. For visualization purposes, we only display locations that recorded more than 100 tests per week.

Customers may choose to mitigate traffic for a variety of reasons, even if the traffic isn't suspected to be malicious. However, for malicious traffic, DDoS mitigation techniques and Web Application Firewall (WAF) Managed Rules are two of the most effective defences against Application Layer (Layer 7) attacks. These attacks can knock an unprotected web site offline or attempt to steal customer data.

Here we show the percentage of global traffic mitigated by Cloudflare on a daily basis during 2025, as well as the percentage of traffic mitigated as a DDoS attack or by WAF Managed Rules.

Bot traffic describes any non-human Internet traffic, and monitoring bot traffic can help spot potential malicious activities. Of course, bots can be helpful too, and Cloudflare maintains a list of verified bots to help keep the Internet healthy.

Looking at bot traffic observed by Cloudflare in 2025, we found that 0% came from the top 10 countries/regions, and that a significant amount of it comes from networks associated with cloud platform providers.

While we can't predict which vertical attackers will target the most, we do know that they all get attacked. No matter the vertical, your best bet is to keep your guard up.

The bars represent the percentage of mitigated traffic aggregated globally that is targeting each category, calculated on a weekly basis. The default view shows the summary for the year.

One important step towards improving Internet routing security has been the adoption of Resource Public Key Infrastructure (RPKI), a cryptographic method of signing records that associate a BGP route announcement with the correct originating AS number (ASN). This enables network providers to validate BGP announcements and reject invalid routes.

Over the course of 2025, the global share of RPKI valid IPv4 routes grew to 53.9%, up 3.9 percentage points from 2024.

We define a “hyper-volumetric network layer attack” as one that operates at Layer 3/4 and that peaks at more than one terabit per second (1 Tbps) or more than one billion packets per second (1 Bpps). Throughout 2025, peak attack sizes have grown significantly across both metrics, up approximately 10x from a bytes perspective, and over 7x from a packets perspective.

Malicious emails include those that would cause harm, including the theft of credentials, data, or money. Cloudflare Email Security protects customers from phishing attacks, including those carried out through targeted malicious email messages.

Below, we show the global percentage of emails analyzed by Cloudflare that were found to be malicious, aggregated weekly.

When carrying out attacks using malicious email messages, attackers use a variety of techniques, which we refer to as threat categories. These categories are defined and explored in detail in Cloudflare's Phishing Threats Report.

Below, we show how threat activity across these categories trended throughout 2025, aggregated weekly. The percentages in the graph will not sum to 100% because a malicious email message may have several threat categories associated with it.

Top-level domains, also known as TLDs, are found in the right-most portion of a hostname. As of November 2025, there are nearly 1,600 TLDs listed in the IANA Root Zone Database. Some top-level domains are favored by threat actors for sending malicious and spam emails.

Based on the analysis of billions of email messages by Cloudflare Email Security in 2025, we have identified the TLDs shown below to be the "most frequently abused", responsible for the largest shares of malicious and spam email messages.